Top 10 Stories

Women in information security are quickly converging on men in terms of academic focus, computer science and engineering, and have a higher concentration of advanced degrees, a report shows. Women remain under-represented in the information security workforce, yet represent a talent resource that the industry should tap into, a report has revealed. Despite the desperate need for information security professionals, the report released by education and certification body for information security professionals (ISC)², in collaboration with...

An arbitrary file upload vulnerability has been discovered in an iOS app that allows an attacker to deliver a malicious package during a file transfer operation. The app is Photos in Wi-Fi v1.0.1, and the vulnerability, discovered by the Vulnerability Laboratory Research Team, allows remote attackers to upload a malicious file to the iOS device which could compromise the security of the iOS wifi app and allowing the attacker to take control. The vulnerability is triggered when the...

UK banking customers have been warned that advanced trojan malware Shifu has migrated from Japan to covertly target and take over their accounts. IBM Security X-Force cybersecurity evangelist, Limor Kessem, explained in a blog post that the banking trojan – discovered less than a month ago – now has 18 UK targets and has ramped up activity to infect hundreds of endpoints per day. Online banking and wealth management customers are first led via email spam to...

The hotel chain bearing 2016 U.S. presidential candidate Donald Trump's name has confirmed that its point-of-sale systems were infected by malware for more than a year. The confirmation comes about three months after the hotel chain said it was investigating reports that its POS systems had been breached. The Trump Hotel Collection, in an undated "legal notice of potential security incident" posted on its website, now warns that POS systems at seven hotels that it manages - in...

A security researcher at Google has discovered more zero-day exploits in Kaspersky's anti-virus software. Tavis Omandy, the security researcher, discovered several vulnerabilities. One involved a security measure Kaspersky had used to randomise memory allocation so hackers could not so easily exploit their location. Unfortunately, the memory allocation was not random and Omandy effectively used a Windows DLL file, used to allow programs to share resources, to effectively execute an attack. A zero-day vulnerability is an...

Thousands of critical medical systems, such as MRI machines, are available for hackers to access online, according to researchers. Some 68,000 medical systems from a large unnamed US health group have been exposed, they said. Security researchers Scott Erven and Mark Collao presented their findings at hacker conference Derbycon. They also revealed that they had created fake medical devices which attracted thousands of hackers. Interfaces connected to medical systems were available via search engine Shodan,...

The results of searches relating to breaking news events and celebrities continue to be loaded with malware, a study has revealed. Model and TV personality Kelly Brook is the most dangerous celebrity to search online, according to Intel Security’s ninth annual survey of risky search topics. Brook is followed by Katie Price, X Factor judges Nick Grimshaw and Rita Ora, and Victoria Beckham as the most dangerous search topics in the UK. Completing the top 10 most dangerous...

Thousands of critical medical systems – including Magnetic Resonance Imaging machines and nuclear medicine devices – that are vulnerable to attack have been found exposed online. Security researchers Scott Erven and Mark Collao found, for one example, a "very large" unnamed US healthcare organization exposing more than 68,000 medical systems. That US org has some 12,000 staff and 3,000 physicians. Exposed were 21 anaesthesia, 488 cardiology, 67 nuclear medical, and 133 infusion systems, 31 pacemakers,...

Piercing a key selling point of commercial cloud computing services, computer scientists have devised a hack that allows an attacker using Amazon's EC2 platform to steal the secret cryptographic keys of other users. The proof-of-concept attack is significant because Amazon Web Services and many other cloud service providers already blocked a previous key-recovery attack on co-located virtual machines that was unveiled in 2009. The paper was one of the first to highlight the security risks...

Several of the world’s most popular pornographic websites were struck by cyberattacks in the past week, according a blog post by the malware hunting software firm Malwarebytes. Sites infected with malicious code included Pornhub and YouPorn, both owned by the Luxembourg-based adult website conglomerate MindGeek. These two sites rack up a combined 800 million visits each month, the post states, citing data from the London-based analytics companySimilarWeb. This particular type of attack is known as a...